feat(server): default validation to strict in serve() (currently None / off)

[bokelley]

Context

The pricing_options shape regression ({\"type\", \"rate\"} shipped instead of spec {\"pricing_model\", \"fixed_price\"}) made it through because Pydantic extra=\"allow\" swallowed it. Strict validation would have caught the bug at boot.

Default serve(validation=ValidationHookConfig(requests=\"strict\", responses=\"strict\")). Adopters who need looser behavior opt out with responses=\"warn\". The v3 ref seller already does this; promoting it to framework default catches the same class of bug across all adopters.

Acceptance Criteria

• serve() default validation is ValidationHookConfig(requests=\"strict\", responses=\"strict\")
• Adopter migration note in CHANGELOG
• Opt-out (responses=\"warn\") documented
• Existing examples / docs updated

Refs

• PR feat(validation): ADCP_VALIDATION_MODE env var + outputSchema on tools/list #391 (validation mode env var)
• v3 ref seller already runs strict (PR feat(v3-ref-seller): enable server validation + declare account.supported_billing #402)

[bokelley]

Triage

Classification: Feature request
Bucket(s): validation, handlers (no matching labels found in repo — gap noted)
Status: ready-for-human

What the experts said:

• ad-tech-protocol-expert: Change is directionally correct; default-value change is breaking per semver; ValidationHookConfig() with no explicit fields is a server-side no-op today (dispatcher reads .requests/.responses directly, not via resolve_validation_modes), so the fix requires explicit ValidationHookConfig(requests="strict", responses="strict"); audit bundled schema additionalProperties posture before landing strict request validation.
• dx-expert: Breaking default; recommends semver-major (5.0.0) and a warn/warn deprecation cycle in one minor first; serve() docstring at line 554 ("keeps validation off (zero overhead)") is currently wrong regardless of this change.
• code-reviewer: Clean and well-scoped; only serve() / create_mcp_server() signatures need changing (internal _serve_* helpers are pass-through, decisioning serve.py picks it up via **serve_kwargs); test_serve_validation_default_is_none explicitly asserts validation=None — CI blocker that must be updated.

My take: All three experts agree the change is correct and well-motivated by a real regression class. The open question for @bokelley is semver: experts split between minor-with-CHANGELOG and major bump (5.0.0) — existing adopters whose handlers pass non-compliant responses will silently start receiving VALIDATION_ERROR on upgrade with no code change, which is the canonical major-version trigger.

Minimum before landing: update test_serve_validation_default_is_none, fix the serve() docstring (line 554), add CHANGELOG migration note and opt-out docs (validation=None or ADCP_VALIDATION_MODE=warn to downgrade).

---

Triaged by Claude Code. Session: https://claude.ai/code/${CLAUDE_CODE_REMOTE_SESSION_ID}

---

Generated by Claude Code